|Publication number||US7437763 B2|
|Application number||US 10/456,606|
|Publication date||Oct 14, 2008|
|Filing date||Jun 5, 2003|
|Priority date||Jun 5, 2003|
|Also published as||US20040250107|
|Publication number||10456606, 456606, US 7437763 B2, US 7437763B2, US-B2-7437763, US7437763 B2, US7437763B2|
|Original Assignee||Microsoft Corporation|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (10), Non-Patent Citations (1), Referenced by (15), Classifications (7), Legal Events (3)|
|External Links: USPTO, USPTO Assignment, Espacenet|
The invention relates generally to computer systems, and more particularly to computer security.
With the growth of computing in general, and the fact that much of today's computing revolves around connectivity to other computer systems to exchange information, security has become an important part of computing. Even though there are various ways users can protect their computer systems against external attacks, hackers are able exploit weaknesses in users' computer configurations, as well as weaknesses in human nature, to attack computers. In part, this is because contemporary security models are complex to users, and some security settings are difficult for users to understand, yet rely on the user to manage and make decisions on security.
For example, contemporary computer users have a number of security settings on their computers that are critical to providing protection from hackers, viruses and rogue programs. The critical nature of these settings dictates that they should not be altered by third parties without user permission, however this is often not the situation with users' computer systems as many malicious computer programs can easily change security settings on a computer without the computer user's explicit knowledge of the change or changes. Furthermore, users may intentionally attempt to change certain settings themselves without completely realizing the security impact of their actions, e.g., a user may lower the security level to temporarily allow some unusual behavior (such as to load a control from a trusted site), but then forget to restore the level to its higher setting.
In sum, users need some level of connectivity to other users' computers, yet have to balance this need for connectivity against some level of vulnerability. Security bulletins and the like are only effective to the extent that users read them and act accordingly. Antivirus programs, firewalls, security patches and other downloads can only prevent certain types of security issues from being exploited, and even then may be too late for many users. In sum, what is needed is a method and system that reduces the complexity of dealing with various security issues and can notify the user of various potential security vulnerabilities, at times when it matters, not after it is too late.
Briefly, the present invention provides a system and method that monitors and advises computer users in real-time as to security related events. This typically includes real-time monitoring for changes to security settings that are initiated by users or any third parties such as application programs that can affect (e.g., diminish) the level of protection on the computer systems, and informing users about the consequences of such changes. In one implementation, a user receives a warning from a security advisor service when a setting is changed or is about to be changed, along with an explanation as to why and/or how the change will diminish the user's protection level. In this way, the user retains control of the machine's settings, but the security advisor can ensure that the user understands the consequences of any security-related action. Further, because the warning is in real-time, the warning appears in the current context of what the user is doing, helping the user recognize and understand the security issue.
In general a security service is provided in software to monitor a user's security settings in real-time. When any of the monitored security settings are changed or are to be changed, by the user or by some application, and the change is related to security (e.g., increases vulnerability), the security service acts in some way, such as to alert the user of the change, provide an explanation about the potential consequences of the change, and offer the user options and recommended solutions. The actions taken may be automatic or may involve the user, and may be based on user configurable action preferences, hardcoded data, downloaded data, performed by default data, or some combination of the above for the many possible security settings on a given machine. Per-user preferences allow the security advisor to operate differently for different users, e.g., default preferences and other settings may vary for a consumer home user versus a business user, an adult versus a child, a sophisticated user versus a novice user, an administrator versus a guest user, and/or virtually any other distinctions that make sense. There may be any number of levels, e.g., a power user level may be somewhere between an administrator level and a guest level.
To monitor and advise, the security service, comprising an in-context security advisor (or simply a security advisor), monitors security-related events such as actual or proposed changes to security settings, and takes actions in response, such as outputting prompts to the user, writing to a log, and/or possibly performing automated actions to prevent (e.g., block or undo) the change from potentially causing damage. The monitoring may be proactive, e.g., by hooking messages, APIs and so forth to monitor for changes to settings before the settings are actually changed, or reactive, e.g., by watching logs, the registry and other such data structures to note when changes have been made. Files can also be monitored by the present invention, e.g., to prevent certain files from leaving the machine.
Based on defaults and/or user preference data, the in-context security advisor can educate users about potential security vulnerabilities and possible solutions, and make a recommendation at the time the security vulnerability is introduced, whether by explicit user action or implicit actions performed by other applications or users. This feature improves users' security awareness, exposes potential security attacks, and prepares users to make educated decisions, thereby increasing security and building trust with the computer user.
The security advisor is a dynamic service that can adjust its operation based on user preferences, policy information, and/or via a connection to a backend server or the like. Automatic updates are performed from the backend server to give the security advisor updated information, such as information about new security attacks and what to do to prevent or correct them, to change default security settings to protect against certain known dangers, revise prompts and explanations, and so forth. The security advisor can also output security information to the backend server, as well as to logs and/or to components that determine the overall health of the machine.
In one implementation, the in-context security advisor operates in an “always on” state to watch security settings in real-time, whereby advice may be given at the time of intrusion, thus giving a user (or a log) the proper context. Automatic correction may be provided to give the user the option to automatically correct and/or block potential security threats.
Other advantages will become apparent from the following detailed description when taken in conjunction with the drawings, in which:
The invention is operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well known computing systems, environments, and/or configurations that may be suitable for use with the invention include, but are not limited to: personal computers, server computers, hand-held or laptop devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
The invention may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and so forth, which perform particular tasks or implement particular abstract data types. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in local and/or remote computer storage media including memory storage devices.
With reference to
The computer 110 typically includes a variety of computer-readable media. Computer-readable media can be any available media that can be accessed by the computer 110 and includes both volatile and nonvolatile media, and removable and non-removable media. By way of example, and not limitation, computer-readable media may comprise computer storage media and communication media. Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by the computer 110. Communication media typically embodies computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of the any of the above should also be included within the scope of computer-readable media.
The system memory 130 includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) 131 and random access memory (RAM) 132. A basic input/output system 133 (BIOS), containing the basic routines that help to transfer information between elements within computer 110, such as during start-up, is typically stored in ROM 131. RAM 132 typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit 120. By way of example, and not limitation,
The computer 110 may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only,
The drives and their associated computer storage media, discussed above and illustrated in
The computer 110 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 180. The remote computer 180 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer 110, although only a memory storage device 181 has been illustrated in
When used in a LAN networking environment, the computer 110 is connected to the LAN 171 through a network interface or adapter 170. When used in a WAN networking environment, the computer 110 typically includes a modem 172 or other means for establishing communications over the WAN 173, such as the Internet. The modem 172, which may be internal or external, may be connected to the system bus 121 via the user input interface 160 or other appropriate mechanism. In a networked environment, program modules depicted relative to the computer 110, or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation,
In-Context Security Advisor
The present invention is, in part, directed towards a service that may be within an overall computer security system, and includes an in-context security advisor component that performs real-time monitoring of security-related events. Among other characteristics, the service unifies various existing security mechanisms, such as antivirus, firewall and intrusion detection mechanisms, so that the user views security from a single, common source, rather than from multiple independent sources. Further, as will be understood, other security-related events are monitored by the service, such as those that the user performs, e.g., changing a registry setting, adding a guest account without a password, running a script that changes an internet security zone or changing one manually, running a macro, loading a control (e.g., an ActiveX® control) and so on. Applications can also change security settings and otherwise alter a system's security, e.g., by changing settings in the registry, by running script, accessing cookies, and so on, and the in-context security advisor monitors those events, also in real time.
Advice may be provided by the in-context security advisor, to educate users about potential security vulnerabilities and possible solutions, and to make a recommendation at the time the security vulnerability is introduced. This real-time advice can occur whether the security is being compromised by explicit user action or implicit actions performed by other applications or users. This feature improves users' security awareness, exposes potential security attacks, and prepares users to make educated decisions, thereby increases security and building trust with the computer user.
In general, the in-context security advisor comprises one or more software components that monitor a user's security settings in real-time. When any of these monitored security settings may be changed (either by the user or by some applications) in a manner that results in a security vulnerability, the in-context security advisor software may take an action, such as an automated action to prevent the change, and/or to alert the user of the change, provide an explanation about potential consequences of the change, and offer the user options and recommended solutions. As will be understood, however, the present invention is not limited to any particular security events or actions, but rather has many applications in computer system security.
In one implementation, the security advisor 202 may monitor for security-related events in two general ways, namely proactively and reactively. Proactive monitoring is represented in
In general, in one implementation, the user decides on how the communication with the security advisor is to occur, (e.g., what level of details to provide, such as based on how technical the user is), and what options the user should be provided with (e.g., whether the security advisor should let the user make every decision, or provide a recommended decision, or take automatic actions for the user). Note that in alternative implementations, the user may be allowed to control, at least to an extent, what information is being monitored, e.g., user preferences can maintain such information.
Files can also be monitored by the present invention. For example, a private file filter 216 may watch for files, as identified by signature, parent directory, filename, file identifier, file attributes or the like, represented in
For other security-related components that cannot be hooked, such as third party antivirus products 222 and firewall/intrusion detection (that evaluates network packets for known attacks) mechanisms 224, the respective log files 226 and 228 are watched to determine what happened with respect to security. A log file provider/filter 228 reports relevant security-related log entries to the reactive event processor 208, which then calls the security advisor 202. As described below, the security advisor 202 can then take an appropriate action, such as based on a local known security attacks database 232, which contains knowledge of security attacks and what to do with them, which may include informing the user of what occurred via a user interface 234.
Similarly, application programs 240 can write to the system (or other) registry 242 or the like, which can impact security. The registry 242 can be monitored and filtered by a component 244, which likewise can report the event to the reactive event processor 208. Web applications can attempt to change defaults, e.g., to take over a default applications handler to change one default application to its own application program, which can be monitored.
As is understood, such components may be external to the security advisor 202, or may be incorporated into the security advisor 202. For example, the security advisor 202 may be implemented in a COM object having defined interfaces, whereby the proactive and reactive event processors 204 and 208 could plug into the security advisor 202. Alternatively, the proactive and reactive event processors 204 and 208 (and possibly the filters 216, 228 and 244) could be incorporated into the security advisor 202.
In this manner, the security advisor 202 acts as a centralized monitor for security-related events, particularly for changes to anything that involves a security setting. Typically these will be events that diminish security, but it is also possible to inform the user when security is increased, or even simply evaluated. For example, a user may want to know whether a website has attempted to run a script that accesses some security settings, even when no change is made.
It should be noted that the security advisor 202 is not a static program, but rather comprises a dynamic service. Thus, another aspect of the security advisor 202 represented in
By way of an example explanation, in one implementation, the Local Known Security Attacks database 232 contains knowledge of security attacks and what to do with them (actions to take), while the event triggered policies 252 contain policy about what to do when a certain event occurs. For example, consider a virus attack that when run cleans out a user's main documents directory. The security advisor 202 obtains this knowledge from the backend 262 through its regular updates, which is written to the local database 232 by the security advisor 202. The data may include the signature of the virus, an explanation of the virus, any possible cure for the virus, or if there is no cure, what options user might have. The event triggered policies 252 has a policy that essentially states that in case a virus is found and a file is corrupted, the system should try to restore the original uninfected file from backups.
Another way in which the security advisor 202 operates as a dynamic service is via a connection 260 (e.g., internet-based) to a backend server 262. Automatic (or possibly manual) updates are performed to give the security advisor 202 whatever information it needs to better advise and protect users. External data sources 264 such as provided by a trusted program producer, can, for example, change default security settings to protect against certain known dangers, such as a malicious web site. Firewall-related data 266, internet-related data 268, antivirus-related data 270 and so forth can be downloaded to the security advisor 202 to influence its operation. Further, the security advisor 202 can report security issues to the backend server 262, whereby information about security is published, e.g., trends and the like among many security advisors on other users' machines can be detected and acted upon. In general, the backend server 262 continues to learn about new security risks and can regularly update the security advisor 202 based on the knowledge learned.
Another aspect of the security advisor 202 is directed to the output of security-related data to other programs and the like, represented in
In addition to (or instead of) outputting data, other actions are feasible, including proactively blocking a change to a security setting, or reactively undoing a change, which is possible if the prior setting is preserved, cleaning up a virus, and so forth. The actions may be automatic or set to be automatic, or proceeded by a prompt, and the prompt may be bypassed (e.g., a checkbox that can be set so as to not show a particular warning again).
The security advisor need not operate in the same way for each user, and indeed, a consumer home user may have very different preferences from a business user. Parents may have different preferences from children, and/or preferences may vary based on a sophisticated user versus a novice user, or some level of sophistication. For example, a sophisticated user may want a lot of information about what occurred, whereas a novice user may want the machine set to automatically do what is correct from a security perspective. Default (and possibly some fixed) preferences may be obtained by subscription, by manually selecting a level, by defaulting relative to a group (e.g., administrator versus power user) or virtually any other selection and distribution criteria.
Turning to an explanation of the event handling logic 300,
If the setting is one that is monitored, step 400 branches to step 402 which tests whether the user has previously indicated not to be alerted for this setting. User preference data is accessed for this information, although it should be noted that policy, time, and so forth may change or override this preference data, e.g., the user may be notified despite having requested not be alerted if policy changes the setting because a particularly bad attack is prevalent on the user's network. Typically, however, the user preference data may be left intact and honored.
Steps 406 and 408 are executed when the user is not to be alerted, and essentially represent extracting the event details, and logging the change event, whether actually performed or proposed and pending. Step 410 represents taking some automated corrective action, if any is set according to the user preference settings, such as undoing a change if made, blocking a pending change from being made, and so forth. Such an action would ordinarily likewise be logged.
If the user is instead to be alerted as determined at step 402, steps 412 and 414 are executed, and essentially represent extracting the event details, and logging the change event, whether actually performed or proposed and pending. Step 416 represents alerting the user to the change. The prompts may vary based on policy, and/or downloading of new prompts. Step 418 represents taking some action, which may include making the change or blocking the change if not made, ignoring the change if made, resetting the setting at some later time (e.g., to allow a one-time exception), sending an email, and virtually any other action. Such an action, if resulting in something different from what is logged, would ordinarily likewise be logged. Note that it is possible to automatically perform an action and also notify a user as to what was done.
As can be seen from the foregoing detailed description, there is provided a method and system for handling the real-time monitoring of computer security-related events. The method and system are flexible and extensible, and provide users with a unified, comprehensive and meaningful in-context way to interact with security at an appropriate level. The method and system thus provide significant advantages and benefits needed in contemporary computing.
While the invention is susceptible to various modifications and alternative constructions, certain illustrated embodiments thereof are shown in the drawings and have been described above in detail. It should be understood, however, that there is no intention to limit the invention to the specific forms disclosed, but on the contrary, the intention is to cover all modifications, alternative constructions, and equivalents falling within the spirit and scope of the invention.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US6647400 *||Aug 30, 2000||Nov 11, 2003||Symantec Corporation||System and method for analyzing filesystems to detect intrusions|
|US7007301 *||Jun 12, 2001||Feb 28, 2006||Hewlett-Packard Development Company, L.P.||Computer architecture for an intrusion detection system|
|US7299504 *||Mar 8, 2002||Nov 20, 2007||Lucent Technologies Inc.||System and method for implementing security management using a database-modeled security policy|
|US7305709 *||Dec 19, 2002||Dec 4, 2007||Mcafee, Inc.||System, method, and computer program product for conveying a status of a plurality of security applications|
|US20020095591 *||Jan 12, 2001||Jul 18, 2002||Daniell William T.||System and method for protecting a security profile of a computer system|
|US20020116631 *||Sep 20, 2001||Aug 22, 2002||Satoru Torii||Method of and system for managing information, and computer product|
|US20030140246 *||Jan 18, 2002||Jul 24, 2003||Palm, Inc.||Location based security modification system and method|
|US20040019807 *||May 14, 2003||Jan 29, 2004||Zone Labs, Inc.||System And Methodology For Providing Community-Based Security Policies|
|US20040049698 *||Sep 6, 2002||Mar 11, 2004||Ott Allen Eugene||Computer network security system utilizing dynamic mobile sensor agents|
|US20040123141 *||Dec 18, 2002||Jun 24, 2004||Satyendra Yadav||Multi-tier intrusion detection system|
|1||*||Microsoft Computer Dictionary□□2002□□Microsoft Press□□Fifth Edition□□p. 47.|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7603333 *||Jun 14, 2006||Oct 13, 2009||Microsoft Corporation||Delayed policy evaluation|
|US7769731 *||Oct 4, 2006||Aug 3, 2010||International Business Machines Corporation||Using file backup software to generate an alert when a file modification policy is violated|
|US8060860 *||Apr 22, 2005||Nov 15, 2011||Apple Inc.||Security methods and systems|
|US8307456 *||Feb 28, 2008||Nov 6, 2012||Red Hat, Inc.||Systems and methods for a secure guest account|
|US8493210||Mar 11, 2010||Jul 23, 2013||Microsoft Corporation||Computer monitoring and reporting infrastructure|
|US8572050 *||Nov 18, 2010||Oct 29, 2013||International Business Machines Corporation||Method and system for real time system log integrity protection|
|US20060242712 *||Apr 22, 2005||Oct 26, 2006||Linn Christopher S||Security methods and systems|
|US20070294198 *||Jun 14, 2006||Dec 20, 2007||Microsoft Corporation||Delayed policy evaluation|
|US20080086513 *||Oct 4, 2006||Apr 10, 2008||O'brien Thomas Edward||Using file backup software to generate an alert when a file modification policy is violated|
|US20090222878 *||Feb 28, 2008||Sep 3, 2009||Walsh Daniel J||Systems and methods for a secure guest account|
|US20110119731 *||May 19, 2011||Canon Kabushiki Kaisha||Information processing apparatus and method of setting security thereof|
|US20110131188 *||Jun 2, 2011||International Business Machines Corporation||Method and system for real time system log integrity protection|
|US20120047578 *||Nov 16, 2010||Feb 23, 2012||Fujitsu Limited||Method and System for Device Integrity Authentication|
|CN102143168A *||Feb 28, 2011||Aug 3, 2011||浪潮(北京)电子信息产业有限公司||Linux platform-based server safety performance real-time monitoring method and system|
|CN102143168B||Feb 28, 2011||Jul 9, 2014||浪潮(北京)电子信息产业有限公司||Linux platform-based server safety performance real-time monitoring method and system|
|U.S. Classification||726/25, 726/1|
|International Classification||H04L9/00, G08B23/00, G06F21/00|
|Jun 5, 2003||AS||Assignment|
Owner name: MICROSOFT CORPORATION, WASHINGTON
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:GUO, BEI-JING;REEL/FRAME:014157/0240
Effective date: 20030604
|Mar 14, 2012||FPAY||Fee payment|
Year of fee payment: 4
|Dec 9, 2014||AS||Assignment|
Owner name: MICROSOFT TECHNOLOGY LICENSING, LLC, WASHINGTON
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MICROSOFT CORPORATION;REEL/FRAME:034541/0477
Effective date: 20141014